CVE-2026-2854
Published: 20 February 2026
Summary
CVE-2026-2854 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the stack-based buffer overflow by applying vendor patches or firmware updates to fix the vulnerable sub_4611CC function in the NTP endpoint.
Information input validation enforces bounds checking and sanitization on the submit-url argument to prevent the buffer overflow manipulation.
Memory protection mechanisms like stack canaries, ASLR, and DEP mitigate exploitation of the stack-based buffer overflow even if invalid input reaches the vulnerable function.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the web NTP config endpoint (AV:N, PR:L) enables remote arbitrary code execution on a public-facing router interface, directly supporting T1190 for initial access and T1068 for privilege escalation to full device control.
NVD Description
A flaw has been found in D-Link DWR-M960 1.01.07. This impacts the function sub_4611CC of the file /boafrm/formNtp of the component NTP Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can…
more
be launched remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-2854 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router running firmware version 1.01.07. The flaw resides in the function sub_4611CC within the file /boafrm/formNtp of the NTP Configuration Endpoint. It is triggered by manipulating the submit-url argument, as classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-20.
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring network access and low attack complexity, with no user interaction needed. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device.
Advisories and additional details are documented in references including a GitHub issue at https://github.com/LX-66-LX/cve-new/issues/11 and VulDB entries at https://vuldb.com/?ctiid.347093, https://vuldb.com/?id.347093, and https://vuldb.com/?submit.754457, along with the vendor site at https://www.dlink.com/. An exploit has been publicly disclosed and may be actively used.
Details
- CWE(s)